> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cowboy.inc/llms.txt
> Use this file to discover all available pages before exploring further.

# cowboy tee

> Publish TEE collateral, endorse measurements, and register attested runners (CIP-23)

## Synopsis

```bash theme={null}
cowboy tee update-collateral --root <path> --effective-at <block> [--private-key <path>] [--rpc-url <url>]
cowboy tee register-key --tee-type <type> --pcr0 <hex> --public-key <hex> [--private-key <path>] [--rpc-url <url>]
cowboy tee verify-cae --cae <path> --job-id <hex> --req-hash <hex> --result-hash <hex> [--proof <hex>] [--private-key <path>] [--rpc-url <url>]
```

`cowboy tee` submits the CIP-23 §3.8 TEE-verifier system actor (`0x05`) instructions to a validator. `update-collateral` and `register-key` are governance operations and must be signed by a key listed in `genesis.system_deployers`; `verify-cae` is how a runner registers by submitting its Composite Attestation Envelope.

Each subcommand accepts `--private-key` and `--rpc-url`, resolved with [key auto-discovery](https://docs.cowboy.inc/cli-specs/key-auto-discovery.md). Every write signs with resource limits from the node's estimate.

## Subcommands

### `cowboy tee update-collateral`

Governance: publish a `CollateralSnapshot` whose `cpu_roots` carry the vendor root (for example the AWS Nitro root).

**Behavior:**

1. Read the DER-encoded root certificate from `--root`.
2. Build a minimal snapshot: `cpu_roots = [root]`, `effective_at` as given, empty `tcb_info`, `qe_identity`, `crls`, `nras_root`, and `allowed_tcb_statuses`, and a one-byte placeholder `snark_verifying_key`.
3. Sign and submit `UpdateCollateral`; print the node response and the transaction hash.

**Flags:**

| Flag | Default | Description |
| - | - | - |
| `--root` | Required | DER-encoded vendor root certificate file |
| `--effective-at` | Required | Block height the snapshot becomes effective at |
| `--private-key` | Auto-discovered | System-deployer private key file |
| `--rpc-url` | Auto-discovered | Validator RPC URL |

**Example:**

```bash theme={null}
$ cowboy tee update-collateral --root ./aws-nitro-root.der --effective-at 1000
  Transaction hash: 0xabc123...
UpdateCollateral submitted: <node response>
```

***

### `cowboy tee register-key`

Governance: endorse a measurement (the operator root) by registering a trusted key for `(tee_type, keccak256(pcr0))`.

**Behavior:**

1. Decode `--pcr0` and compute `keccak256` of it; that hash is the on-chain measurement index.
2. Decode `--public-key`.
3. Sign and submit `RegisterTeeTrustedKey`.

**Flags:**

| Flag | Default | Description |
| - | - | - |
| `--tee-type` | Required | `tdx`, `sev`, `nitro`, or `sgx` |
| `--pcr0` | Required | Raw launch measurement (PCR0 / MRTD), hex |
| `--public-key` | Required | Trusted public key, hex (Ed25519 32 B for nitro; SEC1 for SGX/TDX/SEV) |
| `--private-key` | Auto-discovered | System-deployer private key file |
| `--rpc-url` | Auto-discovered | Validator RPC URL |

**Example:**

```bash theme={null}
$ cowboy tee register-key --tee-type nitro --pcr0 0x9f1c... --public-key 0x4c1d...
  Transaction hash: 0xdef789...
RegisterTeeTrustedKey submitted: <node response>
```

***

### `cowboy tee verify-cae`

Runner: register by submitting a Composite Attestation Envelope.

**Behavior:**

1. Read the D-CBOR CAE bytes from `--cae`.
2. Decode `--proof`; a non-empty proof selects the full (registration) path. The Nitro path ignores its contents.
3. Parse the three 32-byte hashes, sign, and submit `VerifyCae`.

**Flags:**

| Flag | Default | Description |
| - | - | - |
| `--cae` | Required | File holding the D-CBOR CAE bytes (e.g. from `runner-tee assemble`) |
| `--job-id` | Required | Scope id / job id, hex (32 B) |
| `--req-hash` | Required | Request hash, hex (32 B) |
| `--result-hash` | Required | Result hash, hex (32 B) |
| `--proof` | `ab` | Proof bytes, hex; non-empty selects the full path |
| `--private-key` | Auto-discovered | Runner private key file |
| `--rpc-url` | Auto-discovered | Validator RPC URL |

**Example:**

```bash theme={null}
$ cowboy tee verify-cae --cae ./cae.cbor --job-id 0x00..01 --req-hash 0x00..02 --result-hash 0x00..03
  Transaction hash: 0x123abc...
VerifyCae submitted: <node response>
```

## Edge Cases

* `update-collateral` and `register-key` are rejected on chain unless signed by a `genesis.system_deployers` key.
* `--job-id`, `--req-hash`, and `--result-hash` must each decode to exactly 32 bytes.
* The default `--proof ab` is a non-empty placeholder, so the full registration path is selected unless you pass an empty proof explicitly.
* `update-collateral` publishes a snapshot with only `cpu_roots` populated; SGX/TDX collateral fields (`tcb_info`, `qe_identity`, CRLs) are left empty.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.